Is your hotel data safe in the cloud? Questions to ask

Putting your guest list, your bills and your daily takings on the internet can feel risky. A paper register in a locked drawer feels safe. So the question is fair: is your hotel data safe in the cloud?

The honest answer is "it depends on the company". Some are careful and some are not. You cannot inspect their servers, but you can ask good questions and judge the answers. Here are eight to ask, and how we answer them at Xenia.

1. Who can see my records?

Only people you let in. Ask whether each member of staff has their own login, and whether you can choose what each one may see. A receptionist does not need to see the accounts. A cashier does not need to change room rates. In Xenia every person has a role with only the permissions it needs, and you can change them.

2. How are passwords kept?

A responsible company never stores your password in a form it can read. If anyone can email you your old password, it is stored badly. In Xenia, passwords and sign-in codes are never stored in readable form.

3. Can someone change yesterday's records?

This matters more than hackers. The most common damage to a hotel's records comes from inside. Ask whether there is a record of changes that no one can edit or delete. Xenia keeps a permanent audit trail of the important actions: voids, discounts, deletes, rate changes and cash-ups. The owner can run a check that shows it has not been altered.

4. Who has to approve risky actions?

A safe system does not only lock the door. It also asks before something dangerous happens. In Xenia, risky actions, such as voids and large purchase orders, wait for approval from the owner's phone.

5. Will I know when something unusual happens?

Watch for a system that tells you. Xenia has rules that watch for suspicious activity and notify you by email and phone. You do not need to read every record to notice a problem. Read more on the security page and in our post on how money goes missing in a hotel.

6. Where is my data, and can I take it with me?

You should be able to take your records out if you leave. Ask what format they come in, and whether it costs money. A company you cannot leave is a company that owns you.

7. What happens when something goes wrong?

Ask about backups, how quickly the company would restore your records, and how they would tell you about a problem. Be wary of any company that promises nothing can go wrong. Good companies explain what they do when it does.

8. Do you make promises you cannot prove?

Be careful of any company that promises perfect protection, or says you are "100% secure". No one can promise that. We do not claim certifications we have not been audited for. We tell you what we do, such as the audit trail, the approvals and how passwords are kept, and you can check each of them on a demo.

What you do on your side

The software is only half the picture. The other half is how you use it:

• Give each person their own login. Never share one.

• Remove a person's login the day they leave.

• Use roles. Do not make everyone an owner.

• Look at the exceptions every morning. See what an owner should read every morning.

Keep the devices safe too

Most problems start on a phone or a computer, not on the company's servers. A receptionist who writes her password on a sticker under the keyboard has weakened the best system in the world. Agree a few simple rules with your staff:

• Never share a password, even with a manager.

• Lock the computer, or sign out, when you leave the desk.

• Do not sign in on a stranger's phone or a shared computer in a business centre.

• If a phone with the hotel's app on it is lost, tell the owner at once so the login can be stopped.

These cost nothing, and they close the most common gap of all.

A fair comparison

Compare the cloud with what you have today. A paper register can be lost, burned or quietly changed. A single computer can fail, be stolen or have a virus. A cloud system has its own risks, and its own strengths: records kept off the premises, a change log, and access you control. The best answer is the one that gives you records you can trust and see. To see how this works on screen, book a demo.